How to use multiple ldapURLs and baseDNs?

[Peter Schober]

* Lucia Siochi <Lucia.Siochi at cpcc.edu> [2016-03-14 23:52]:
> Our students and employees are in separate AD trees (not sure if
> that's the correct terminology). Basically, the
> idp.authn.LDAP.ldapURL for employees is different than the ldapURL
> for students.
> 
> Also, within the AD "tree" for employees, there are multiple
> idp.authn.LDAP.baseDNs for authentication to check.

Personally I'd set the search base to something from where it will
find both employees and students (e.g. the actual baseDN of the LDAP
server, or the most specific part of the tree they share) and set
idp.authn.LDAP.subtreeSearch to true.

Whether or not that works may depend on your MS-AD deployment (no
idea, never had to use it) from looking at this -- never mind the IDP
version that page is for as it about MS-AD:
https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues#LdapServerIssues-MicrosoftActiveDirectory
But for authentication (not attribute resolving) talking to the global
catalog port should probably work?

> I need to be able to check all these locations for
> authentication. Does anyone else have this situation? I saw a post
> that was similar, but it was for IdPv2.  I am using IdPv3.

Here's v3 using the internal LDAP authn:
("Extensible Matching" or "Aggregate DN Resolver")
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-SingleDirectorywithmultiplebranches

I don't see a need but you could also switch to JAAS
https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration
and then stack two modules as in IDPv2, cf. "Stacking Login Modules" on
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass

Both the IDPv3 and the v2 docs have examples for exactly your use case
of searching the same directory twice, starting from different search
bases.
-peter